Vlad: Forty percent of enterprise apps will have a task-specific AI agent running inside them by the end of this year. Gartner's number, not a vendor slide.

Vlad: And by 2027, Gartner says enterprises will pull the plug on forty percent of those same agents. Demoted. Decommissioned. Shut off.

Vlad: Not because the model got worse. Because nobody could answer one question after something went wrong: who authorized this.

Vlad: There's a case going around right now. A support agent issues a credit to a customer account. No human sign-off. Every dashboard is green. Monitoring's fine, the agent did what it was built to do.

Vlad: Except finance goes looking for the policy that actually authorized that transaction. And there isn't one. The company eats the loss. The vendor who sold the platform does not.

Vlad: That's not a model problem. That's an architecture problem. And it's the one most IT leaders aren't asking about yet, because they're still checking whether the thing works, not whether anyone could prove it was allowed to.

Vlad: Today we're going through five stories that all land on some version of the same fault line. Who's accountable when the agent gets it wrong. What's actually underneath that failure. And what it costs, in money and in people, to close the gap instead of discovering it the hard way.

Vlad: Welcome to Hack the Stack, the weekly show for senior IT and AI leadership who actually have to deliver, govern, and maintain AI in production. I'm your host, Vladimir Cvijanović, joined by Kate, our technology and data architecture lead, and Zoltan, our old-school IT skeptic.

Vlad: Every Tuesday, we skip the vendor marketing pitch and break down what's actually happening across the stack.

Vlad: Let me get right into this week's first topic.

Vlad: CIO.com, this week. Piece called "Your AI agent may have made the decision, but your company owns the risk." Richard Ewing. He draws a line between four things people keep collapsing into one thing: monitoring, auditability, authorization, accountability.

Kate: Right, and that's the part nobody wants to sit with. Monitoring tells you the agent ran. It doesn't tell you it was allowed to run.

Kate: Ewing's line is good. "It is easy to assume that an agent inherits some of the trust of the application it lives inside." It doesn't.

Zoltan: Ah. The agent living rent-free inside your Salesforce instance, borrowing the landlord's credibility.

Kate: There it is.

Zoltan: I have been saying this for two years. Nobody asks who signed the lease.

Vlad: Give the audience the mechanism, Kate. Not the metaphor.

Kate: Sure. So Salesforce, SAP, Workday, these platforms have their own permission model, their own trust boundary. When you drop an agent in there, IT assumes the agent respects that boundary the same way a human user would.

Kate: It doesn't, automatically. An agent scoped wrong can read across departments it was never meant to touch. Ewing's examples: a purchasing agent skips the three-bid requirement on anything over fifty grand. A sales agent quietly offers payment terms that break revenue recognition rules. A support agent pulls client records from a department it has no business being in.

Zoltan: None of those failures show up in uptime monitoring.

Kate: Exactly. That's the whole point.

Vlad: And NIST is on record saying the same thing from the audit side. Fragmented logging across distributed systems. Their own phrase: the relationship between monitoring and auditing is still unresolved.

Zoltan: Unresolved. My favorite word from a standards body. Means "we noticed, we have no idea what to do about it."

Vlad: Fair. But the fix isn't obvious either. Ewing's honest about that.

Kate: Yeah, because the easy answer, require human sign-off on every action, doesn't survive contact with scale. You put a human in the loop on hundreds of agent actions a day, that human stops reading them. It becomes a rubber stamp.

Zoltan: Or you pay full price for the agent's subscription and full salary for the human checking its work, and you've bought yourself nothing.

Kate: Which, credit where due, is the correct read.

Zoltan: I'll allow the compliment. Once.

Vlad: Ewing closes with six questions a leadership team should be able to answer before an agent goes live. Who owns and audits the operational rules, by name. Can you prove, on demand, both the context and the authorization behind a specific decision.

Vlad: Most companies I've sat across from cannot answer either one.

Kate: The purchasing agent example is worth sitting with a second longer, actually. Three competitive bids above fifty thousand dollars. That's not some obscure internal rule, that's a procurement control that exists because someone, at some point, got burned without it.

Zoltan: Someone always got burned first. That's how every control in every company ever got written. Blood, then policy.

Kate: And an agent doesn't know the history behind the rule. It just knows whether the rule is coded into its permissions or not. If it isn't, it'll happily skip the step, because nothing told it that step mattered.

Zoltan: Which is the real difference between a human employee cutting a corner and an agent cutting the same corner. The human at least knows they're cutting it.

Vlad: Right, and that's the audit trail problem in one sentence. A human who skips the process leaves a trace of intent you can question later. An agent that skips it just executed, cleanly, with no sense that anything was skipped at all.

Kate: So the fix isn't "make the agent smarter." It's "make the permission boundary explicit enough that skipping isn't even an option the agent has."

Zoltan: That, I actually agree with. Fewer smart agents, more boring, well-scoped permissions. Nobody wants to hear that in a keynote.

Zoltan: Most companies cannot answer who approved the last vendor contract either. This is not new. It just has a faster failure mode now.

Vlad: That's a fair bridge, actually. Because the next piece is exactly about who gets stuck holding that failure.

Kate: One more thing worth naming before we move on. This isn't unique to any one platform. Ewing names Salesforce, SAP, Workday specifically, but the pattern holds for any embedded-agent product from any vendor.

Zoltan: Which is the part every vendor sales call leaves out. "Our agent is secure" usually means "our agent respects our own platform's boundaries." It says nothing about whether it respects yours.

Vlad: That's worth repeating for anyone evaluating a vendor pitch right now. Ask specifically where the agent's permission boundary ends, and where your own organization's controls are supposed to pick up. If the vendor can't answer cleanly, that's your answer.

Vlad: Also CIO.com, same week. "AI failures are inevitable. So is the CIO getting blamed." Grant Gross wrote it.

Vlad: Fifty-two percent of IT leaders say the CIO takes the blame when an agent screws up. Six percent say legal or compliance takes it instead.

Kate: Fifty-two to six. That's not close.

Zoltan: And how many of those CIOs actually chose the agent in the first place.

Vlad: That's the mechanism. The article names it directly: accountability gap opens whenever responsibility exceeds authority. A business unit buys an agent through shadow IT, or the board mandates something at a conference, and the CIO never sat in the room. Then it breaks.

Vlad: There's a quote from Boris Kolev, Global Head of Technology at JA Worldwide, that names it plainly. It is a serious governance problem whenever responsibility exceeds authority. If a business team chooses an agent and the CIO is expected to answer for every failure, the organization has created an accountability gap.

Kate: And the CIO's name is on the incident report.

Vlad: There's a quote from a VP at 8x8, Morgan Watts. "The CIO is now the last line of defense for AI, and in a lot of organizations, that's a job they didn't apply for."

Vlad: "They didn't choose the vendor, and they don't always have the audit trail. But when an AI agent gets it wrong, their name is the one in the incident report."

Zoltan: That is, unfortunately, well put.

Kate: Careful, Zoltan, two compliments in one episode.

Zoltan: I am capable of restraint. Rarely exercised.

Vlad: There's a harder number underneath it too. As of February this year, seventy-one percent of IT leaders believed they had until midyear to prove AI was delivering value, or face budget cuts and job risk themselves.

Zoltan: So the clock was already running before anyone fixed the governance problem. Convenient.

Vlad: And IDC's prediction on top of that: up to two hundred large companies could see lawsuits, regulatory fines, or CIO terminations over a four-year window, tied directly to inadequate agent controls.

Kate: Two hundred is not a rounding error. That's a real number of real careers.

Zoltan: Somewhere a board is currently drafting a press release that starts with "we take this extremely seriously."

Vlad: Here's what I want listeners to sit with though. The article doesn't let the CIO entirely off the hook either, and that's the right call. You didn't pick the vendor, fine. But building the governance and control layer, that's still yours to own, whether or not you chose what's running inside it.

Kate: Right, the fix isn't "stop blaming the CIO." It's automated governance tooling, and explicit sign-off from a named executive on deployment risk, before it ships. Not after the incident report gets written.

Zoltan: Sign off before, not apologize after. Radical concept.

Vlad: There's also a piece of this that isn't just about the CIO carrying the weight alone. Gil Elbaz, cofounder and Chief AI Officer at Onyx Security, and Samuel Wilson, CEO at 8x8, both push toward distributing that governance responsibility more broadly. Not stacking it entirely on one desk.

Kate: Which makes sense structurally. If the business side chose the tool, the business side should carry some of the sign-off weight too. Not just inherit the blame-free upside and hand IT the entire downside.

Zoltan: A novel idea. The people who make the decision also own some consequence of the decision.

Vlad: It shouldn't be radical. It should be table stakes. But it isn't yet, which is exactly why this is a story.

Vlad: Alright. Now the piece where I want you two to actually get technical, because this one has real numbers behind it. Diginomica, Jim Webber, Chief Scientist at Neo4j. Headline: cutting AI budgets won't fix token shock.

Kate: Oh, I like this one. Finance teams throttle the AI token budget because the bill's too high, and Webber's saying that's treating the symptom.

Zoltan: Naturally the graph database guy thinks the answer is more graph database.

Kate: Let the numbers talk before you write him off. There's a Newcastle University study behind this, not just Neo4j marketing.

Kate: Graph-plus-vector retrieval versus vector-only. Vector-only refuses to answer seventy-one point nine percent of complex questions. Add the graph layer, that refusal rate drops to thirty-four point seven percent.

Zoltan: So the vector-only system just shrugs at seven out of ten hard questions.

Kate: Basically. And truthfulness improved roughly eighty percent with the graph layer added. That's not a marginal gain.

Vlad: Walk through why, though. Not just the headline stat.

Kate: Sure. Each individual graph retrieval call costs about ten percent more tokens than a vector-only call. That part's real, that's the part finance sees on the invoice.

Kate: But in an actual agentic workflow, the agent's making multiple calls, trying, failing, retrying, because a poorly-grounded vector system doesn't know what it doesn't know. That retry loop burns way more tokens than the ten percent premium ever does.

Zoltan: So the ten percent tax up front is cheaper than the compounding cost of the system guessing wrong repeatedly.

Kate: Exactly. Webber's got this line I love. Imagine a warehouse has twenty widgets. Two weeks ago you sold twenty widgets. A vector system has no idea that number's stale, it'll happily tell you the twenty widgets are still there.

Zoltan: Because nothing in a vector embedding says "this fact expires."

Kate: Right, there's no structured, current state. A graph can represent that state directly and update it. That's the actual mechanism, not magic, just a different data structure for a different job.

Vlad: He also flags something I think matters for anyone building agent evaluation pipelines. Models grading their own output as a substitute for real grounding.

Kate: Yeah, his phrase was models can "get high on their own supply." The generative loop reinforces its own bias if you let it self-grade instead of checking against something structured and external.

Zoltan: A model marking its own homework. Shocking that it gives itself good marks.

Vlad: Is this hard to stand up, though? Because "just add a graph" sounds simple until an IT director has to actually budget for it.

Kate: It's more approachable than people assume, honestly. Webber's own words, even a lightweight graph, something you don't have to sweat over for hours, brings real benefit fast. It's not a six-month data modeling exercise to get value.

Zoltan: There are caveats though, let's not pretend it's free.

Kate: No, agreed, there are real ones. Text-to-Cypher, natural language into a graph query, has its own error rate, and it gets worse as the query gets more complex. And models don't naturally reach for a graph tool unless you deliberately prompt them to.

Zoltan: So it still requires someone who knows what they're doing to wire it up correctly. Which is the part every vendor pitch conveniently skips.

Vlad: Put a number on that error rate for me, if there is one in the piece.

Kate: The study doesn't hand us a single clean percentage for Cypher error rate specifically, which is honestly the right amount of honesty from Webber. He says it plainly instead of manufacturing a stat: complexity drives it up, and nobody should assume zero.

Zoltan: A vendor admitting his own tool has an unsolved edge, instead of a slide with a fake precision number on it. Mark the date.

Kate: See, restraint. You're capable of it after all.

Zoltan: Once a quarter. This is this quarter's allotment.

Vlad: The other thing worth naming for a technical lead listening right now: this isn't an either-or between vector and graph. The study pairs them. Vector for the fuzzy, semantic-similarity part of the question, graph for the part that needs actual current state.

Kate: Right, nobody's saying rip out your vector database. It's "add the piece that vector search was never designed to do," which is track relationships and current facts, not just similarity.

Vlad: That's the piece I want on record. This isn't "buy Neo4j and your token bill disappears." It's "the architecture decision changes where your cost actually lives," and that's a real distinction for anyone whose finance team is currently just capping the API budget and hoping.

Vlad: Webber's broader read is worth repeating too. Everyone rushed at AI because it looked appealing. Now a more measured mindset is taking over.

Zoltan: First sensible sentence I've heard from a vendor blog all year.

Vlad: Good, because the next story is exactly about what happens when the measured mindset arrives too late, after the rush already broke something.

Vlad: CIO Dive, a Collibra study run through Harris Poll. Three hundred data management, privacy, and AI decision-makers. Seventy-two percent say AI initiative failures trace back to a poor data foundation.

Kate: Seventy-two percent isn't a fringe opinion, that's the majority explanation.

Zoltan: And fewer than twenty-five percent of enterprises have actually scaled anything past a pilot. So most of them are diagnosing a failure they haven't even fully had yet.

Vlad: There's a distinction in here I want to make sure lands, from Felix Van de Maele, Collibra's CEO. Traditional data infrastructure was built to serve human analysts. A person looking at ambiguous or incomplete data applies judgment before acting on it.

Kate: Right, a human sees a weird number and pauses. An agent doesn't pause. It acts on the incomplete data with full confidence, and the error just compounds downstream instead of getting caught early.

Zoltan: That's the widget warehouse story again, from a different angle.

Vlad: It is. Same failure mode, this time with a survey behind it instead of one anecdote. Fifty-three percent are moving AI reporting lines organizationally closer to the data function. Fifty-eight percent are trying to establish clear accountability for AI-generated output.

Kate: And only fifty percent actually trust their agents' output accuracy. That's basically a coin flip, from the people running the programs.

Zoltan: A coin flip they're currently putting into production.

Vlad: A few more numbers from that same survey worth putting on the table. Eighty-seven percent say their teams regularly verify agent context accuracy by hand.

Kate: Which sounds responsible, until you notice the next number. Over half report employees spending actual hours manually reviewing AI output.

Zoltan: So the labor savings from the agent gets partially eaten by a human now checking the agent's homework.

Kate: Right, and there's a data-access number underneath that too, pulled from a related Google Cloud and MIT report. Forty-five percent average data access rate for AI systems across these enterprises.

Vlad: Meaning the agent can only see, on average, under half of the data it might actually need to make a good call.

Zoltan: Then the fifty percent trust figure starts making a lot more sense. Half the data, half the confidence. Almost tidy.

Kate: And to their credit, fifty-one percent are investing specifically in data lineage and documentation because of AI, and ninety percent say they're actively preparing for AI regulation. So it's not that nobody's moving. It's that the moving is happening after the exposure, not before it.

Vlad: To be fair to the piece, it doesn't offer a counterweight. It presents the seventy-two percent figure as the dominant explanation, full stop, no organization cited that succeeded despite a weak data foundation through some other compensating control.

Zoltan: Convenient, when the company running the survey happens to sell data governance software.

Kate: You say that about literally every survey, Zoltan.

Zoltan: Because it is literally true of every survey.

Vlad: It doesn't make the underlying number wrong, though. It just means take the seventy-two percent as directional, not gospel.

Vlad: What I'd flag for our audience specifically: this connects straight back to the graph piece Kate just walked through. A weak data foundation is exactly the condition where an agent confidently acts on stale or ambiguous information. Structure at the data layer is one real fix. Not the only one, but a real one.

Kate: And it's not glamorous work. Nobody puts "fixed our data lineage" on a conference keynote slide.

Zoltan: No, but it's the part that actually determines whether the keynote-worthy agent demo survives contact with real production data.

Vlad: Last topic. And this one's a bit different in texture, because it's not a vendor survey, it's people on stage at a protocol conference. AGNTCon plus MCPCon, Amsterdam. Diginomica covered it.

Vlad: Named speakers, real weight behind them. Nick Cooper from OpenAI. David Soria Parra, Anthropic, one of MCP's co-creators. Kuba Herczyński from Google. Clare Liguori, AWS. Marlene Montgomery, GitHub.

Kate: These are the people who actually build the plumbing everyone else is arguing about. Anthropic's MCP protocol alone has crossed a billion lifetime tool calls, five hundred million SDK downloads.

Vlad: And Kuba Herczyński from Google was on stage representing the A2A side of it, agent-to-agent, not just agent-to-tool. Worth noting these are two different protocols solving two different parts of the same problem, and both were represented in the same room.

Zoltan: Two competing standards from two different companies, in the same room, agreeing on stage. That never lasts.

Zoltan: Numbers that mean something to about four people in our audience and impress the rest by sheer size.

Kate: Fair, but here's the actual argument, and it's the interesting part. Enterprise leaders read reports like Deloitte's, WEF's Future of Jobs, see that thirty-nine percent of core skills are projected to change by 2030, and they panic-fund big proprietary reskilling programs. The article cites two thousand dollars plus per employee, typical spend.

Zoltan: And the people who actually build these systems say that's the wrong move.

Kate: That's exactly the pushback. Their line, quoted directly: basically everything stays relevant. Fundamentals, architecture, testing, protocol design, security, version control, peer review. None of that depreciates.

Kate: What's changing is syntax-level coding skill specifically. That matters less now. What's rising is systems thinking, retrieval design, tool integration, evaluation discipline.

Vlad: Liguori from AWS made a historical comparison I think is the sharpest thing in the piece. She likened this moment to serverless computing around 2014.

Vlad: Back then, everybody had to figure it out themselves, no shared playbook, genuinely difficult. Within a decade, shared frameworks and patterns emerged, and the cognitive load dropped for everyone who came after.

Kate: Her conclusion: invest in portable skills, not proprietary certifications that lock people into one vendor's specific workflow.

Zoltan: I want to name the obvious thing here, though. The people saying "don't overspend on reskilling, our tools are basically fine as-is" are the people who build the tools. That's not a neutral panel.

Kate: That's fair, actually. I'm not going to pretend it isn't a little self-serving.

Zoltan: Doesn't mean they're wrong. Just means someone should say it out loud instead of nodding along.

Vlad: Which is exactly why we're saying it out loud. But underneath the self-interest, there's a real, useful distinction: don't confuse "the syntax changed" with "everything you know is obsolete." Most of what a senior technical lead actually knows doesn't depreciate.

Kate: And tie that back to the certification budgets specifically. Two thousand dollars a head on a proprietary course teaches someone one vendor's syntax, which is exactly the layer that's moving fastest and depreciating soonest.

Zoltan: Meanwhile nobody's budgeting time for the technical lead to actually learn how to evaluate whether an agent's output can be trusted, which is the skill every single story on this episode has needed somewhere in it.

Kate: That's actually the connective tissue across the whole hour, isn't it. Evaluation discipline. Knowing when to trust the output and when to check it.

Vlad: It is. And it's not a skill you buy in a two-day certification. It's built by actually running these systems and getting burned a few times in a controlled way, before you get burned in production.

Vlad: Some real numbers behind the pace of change, regardless of who's spinning it. GitHub, March this year, seventeen point eight million pull requests co-authored by agents. By August, two point nine billion commits pushed, roughly three times all of last year combined.

Zoltan: The volume is real. Whether the quality kept pace with the volume is a separate question nobody in that room was going to ask out loud.

Kate: Also fair. Though Amazon's Infinity Project claim is the one that actually made me pause, seventy-five thousand agents packed into the memory footprint of a Raspberry Pi.

Zoltan: A number designed entirely to be repeated in exactly this kind of conversation.

Vlad: Which it just was. Point taken either way.

Vlad: Alright, let's pull this together, because five stories in, there's one line running underneath all of it.

Vlad: Agents are shipping into production faster than the structures needed to run them responsibly. Not the models, the structures. Who's authorized to act, who answers when it breaks, whether the data underneath is solid enough to act on, and whether the people running it actually have the skills the job now needs.

Vlad: Ewing's piece gave us the architecture side of that gap, an agent doesn't inherit the trust of the app it lives inside. Gross's piece made it personal, the CIO answers for a decision they often didn't make. Webber gave us one real fix at the data-architecture layer, structure beats brute-force token cutting. Collibra's survey gave that same idea a number, seventy-two percent. And the MCP conversation closed it out from the people side, the fundamentals hold, what's shifting is where the value sits.

Vlad: For a mid-sized company trying to move an AI pilot into something that actually runs the business, that's the whole game. Not "is the model good enough." It almost always is, by now. The real question is whether anyone can answer, in writing, who's accountable, on what data, with what authority.

Kate: And none of these five stories needed a bigger model to fix. Every single fix on this episode was structural. Permission boundaries. Sign-off before deployment. A graph layer under the vector store. Data lineage. Evaluation skill in the people running it.

Zoltan: Which is the least exciting sentence you can say at a conference keynote, and the most true one on this show.

Vlad: That's the whole reason this show exists. Nobody's going to put "we wrote down who's accountable" on a stage slide. But it's the difference between an agent that survives contact with production and one that gets quietly decommissioned eighteen months from now, becoming one more entry in Gartner's forty percent.

Vlad: So here's the one thing I'd actually act on this week if I were running IT at a mid-sized company. Before you scale a single agent past pilot, get one page written down. Who owns it. What data it can touch. What it's authorized to do without a human. And who signs off before it goes live, not after something breaks.

Vlad: If you can't produce that page today, that's not a reason to panic. It's just the actual next step, and it's a smaller one than most people think.

Kate: And if you're staring at a token bill wondering whether to cut scope, go back to Webber's point before you go back to finance. Check whether the cost is coming from one clean call or from an agent retrying because the ground underneath it wasn't solid. Those are two very different problems with two very different fixes.

Zoltan: And if someone tells you the fix is simply "buy our platform," ask them the same six questions Ewing raised at the top of the show. Who owns it, what can it touch, who signs off, and can you prove any of that on demand.

Zoltan: If the answer is a shrug, you don't have a governance problem yet. You have a countdown.

Vlad: That wraps up this week's episode of Hack the Stack. If you're building or scaling AI infrastructure in your organization and want to discuss how to solve these delivery or governance bottlenecks, let's talk. You can book a call directly via the link in the show notes, or send me a direct message on LinkedIn.

Kate: We'll be back next Tuesday with another breakdown of what's real and what's hype across the stack.

Zoltan: Try not to deploy anything into production before then.

Vlad: Until next week.